[PLUG] 'logcheck'

[JP Vossen <jp@jpsdomain.org>]

I have said this before but I am a huge fan of the Debian/Ubuntu 
implementation of logcheck.  I am also not aware of any other major 
distro that makes using logcheck so "built-in" and easy.

If you run any kind of Debian/Ubuntu server, you really need to be using 
this.  As soon as something bad or new happens, you get an email.  It's 
like magic.

----- cut here -----
logcheck - mails anomalies in the system logfiles to the administrator
logcheck-database - database of system log rules for the use of log checkers

Description: mails anomalies in the system logfiles to the administrator 
Logcheck was part of the Abacus Project of security tools, but this 
version has been rewritten.

Logcheck helps spot problems and security violations in your logfiles 
automatically and will send the results to you in e-mail.

Homepage: http://www.logcheck.org/
----- cut here -----

Logcheck is a simple yet great idea.  You have 3 pattern (grep regex) files:
	Known bad
	Looks bad but isn't
	Known good

Logcheck looks for "known bad" things but removes stuff that "looks bad 
but isn't" and outputs to "this is bad."  Then it removes the "known 
good" and stuff that "looks bad but isn't" and outputs to "this is 
unknown."  Over time, as you tune your files, you end up only being 
alerted to known bad or new (not yet classified) stuff.  Brilliant.  I 
even did a (cheesy) Windows port of it:
* http://www.jpsdomain.org/windows/winlogcheck.html

But the best about the Debian/Ubuntu implementation is that almost all 
of the patterns you need are already Just There.  I usually only have to 
add a handful to work around odd things I'm doing or minor bugs.

Later,
JP

PS--Maybe someone should put together a Debian sysadmin tips preso, with 
logcheck, fcheck, etckeeper, etc.
----------------------------|:::======|-------------------------------
JP Vossen, CISSP            |:::======|      http://bashcookbook.com/
My Account, My Opinions     |=========|      http://www.jpsdomain.org/
----------------------------|=========|-------------------------------
"Microsoft Tax" = the additional hardware & yearly fees for the add-on
software required to protect Windows from its own poorly designed and
implemented self, while the overhead incidentally flattens Moore's Law.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug